The scam exchange of 2026 doesn't look like a scam. It has a polished dashboard, a responsive mobile app, fabricated trading volume, and maybe even a deepfake video of a well-known CEO endorsing it. Chainalysis estimates that $17 billion was stolen through crypto scams and fraud in 2025 alone. The FBI logged 181,565 cryptocurrency-related complaints that year, averaging $62,604 per victim. And impersonation scams, fraudsters posing as legitimate exchanges, wallets, and support agents, grew 1,400 percent year over year.
Most of those losses weren't caused by sophisticated hacking. They were caused by people depositing money into platforms they never verified. Here are seven checks that separate a legitimate exchange from a convincing fake, whether you're looking at a major centralized exchange or a smaller instant swap service.
1. Check the Regulatory Registration, Directly
A legitimate exchange operating in a regulated market should appear in the relevant government database. Not on its own website. On the regulator’s.
- United States: Search the platform’s legal business name on FinCEN’s MSB Registrant Search at msb.fincen.gov. Any exchange processing crypto transactions in the U.S. should be registered as a Money Services Business.
- European Union: The MiCA framework now requires Crypto-Asset Service Providers to obtain authorization. ESMA’s centralized register is expected to go fully live by late 2026. Until then, check with national competent authorities.
- United Kingdom: Search the FCA Register for the company’s registration.
By February 2025, more than 50 crypto firms had already lost their EU licenses for failing to meet AML or KYC requirements. If a platform claims to be licensed but the number doesn’t check out on the regulator’s own portal, that’s your answer.
For non-custodial instant swap services that don’t require user accounts, the regulatory framework is different, they typically don’t hold customer funds or manage accounts, so the same CEX licensing rules may not apply. In that case, shift your verification focus to operating history, public reviews, and fee transparency, covered in checks 3, 5, and 6.
2. Verify the Company Behind the Interface
Every legitimate platform traces back to a registered legal entity. Look for:
- A named company with a verifiable jurisdiction of incorporation
- Identifiable leadership, at least one named principal, compliance officer, or AML contact. Anonymous teams are a red flag.
- Contact information, a working email, a phone number, and ideally a physical address. If support only exists through a chatbot and a web form, that’s thin.
After FTX, the crypto industry learned that brand recognition isn't proof of legitimacy. Sam Bankman-Fried ran a multibillion-dollar operation with institutional backing and celebrity endorsements, none of which prevented the collapse that wiped out customer funds. The company behind the interface matters more than the interface itself.
3. Look at Operational Track Record
A platform’s history tells you more than its marketing.
- How long has it been operating? Run a WHOIS lookup on the domain to confirm registration date. A site claiming years of history on a domain registered six months ago is lying.
- How many transactions has it processed? Legitimate platforms either publish verifiable volume data or can point to third-party listings on CoinGecko or CoinMarketCap.
- Has it survived a market cycle? Any exchange that existed before 2022 and still operates has weathered at least one severe downturn, the Crypto Winter, the FTX fallout, and the associated contagion. That survival is a data point.
- How has it handled incidents? No platform is incident-free. What matters is how problems were resolved, publicly, quickly, and with customer funds intact.
4. Examine Security Architecture
Four controls separate serious platforms from the rest:
Proof of Reserves. This is a cryptographic mechanism that lets you verify the exchange actually holds the funds it claims to hold. Kraken, OKX, and Crypto.com publish this regularly. Coinbase publishes SEC-audited financials as a public company. Any exchange that refuses to disclose reserve data in some verifiable form in 2026 is behind the curve.
Cold storage ratio. What percentage of customer assets are held offline? Coinbase reports 98 percent. OKX discloses 95 percent. The higher the ratio, the less exposed funds are to remote attacks.
Two-factor authentication. It should be available, and ideally mandatory. Authenticator-app-based 2FA, not SMS, is the minimum standard.
Independent audits. Recurring security reviews by third-party firms like CertiK, Halborn, or Trail of Bits. A one-time badge from three years ago doesn’t count.
For non-custodial services, the security model differs by design. Since the platform never holds your balance between transactions, the custodial risks, Proof of Reserves, cold storage, don’t apply the same way. Your risk window is limited to the transaction itself, making operating history, review quality, and support responsiveness your primary verification signals.
5. Test Fee Transparency
A legitimate exchange shows you exactly what a transaction will cost before you confirm it. No buried spreads. No mysterious "network fees" that don’t match actual blockchain gas costs. No surprise deductions after the fact.
Run this test: start a transaction, without completing it, and see whether the platform displays the exchange rate, the fee, and the final amount you'll receive, all in one view, before you commit any funds. If any of those are missing or vague, that's a structural red flag.
Platforms like Boomchange display the rate and the exact output amount upfront before you send anything, a transparency feature that doubles as a verification signal. If a platform won’t show you the cost until after you’ve deposited, ask yourself why.
6. Read Reviews, the Right Way
Don’t skim star ratings. Read the one-star reviews in detail. Look for patterns:
- Withdrawal blocks: multiple users reporting frozen funds, especially after trying to withdraw larger amounts. This is the single most common sign of a fraudulent or failing platform.
- Customer support silence: complaints about unresponsive or nonexistent support during critical moments.
- Unexplained fees: users reporting charges that weren’t visible before the transaction.
Trustpilot, Reddit crypto communities, and Google reviews are useful cross-references. A platform with a 4+ rating across 100+ independent reviews and a multi-year profile is structurally different from one with 15 five-star reviews posted in the same week.
Also check whether the exchange responds publicly to negative reviews. Legitimate platforms address complaints. Scam operations ignore them or delete them.
7. Run a Test Transaction Before You Trust
The strongest verification is behavioral, not informational. Before depositing any meaningful amount:
- Start small. Send the minimum amount, $10 or $20. See if it arrives correctly and promptly.
- Test a withdrawal. Pull the money out. Did it arrive? How long did it take? Were there any surprise fees?
- Contact support. Ask a simple question before you need urgent help. How quickly do they respond? Is it a real person?
If a platform handles a small deposit, a small withdrawal, and a support interaction cleanly, it has passed a practical test that no amount of website polish can fake. If anything feels off at this stage, delays, errors, evasive answers, walk away while the cost is $10, not $10,000.
Red Flags That Should Stop You Immediately
- Guaranteed returns. No legitimate exchange promises fixed profits. Crypto markets are volatile by nature.
- Pressure to act fast. "Limited spots," countdown timers, "offer expires tonight." Legitimate opportunities don’t need urgency.
- Requests for your seed phrase or private keys. No real exchange, wallet, or support agent will ever ask for these. Ever.
- "Taxes" or "fees" required before you can withdraw. This is the hallmark of advance-fee fraud. Legitimate platforms deduct fees from the transaction, they don’t ask for fresh deposits.
- No verifiable company, team, or registration. If you can’t trace the platform to a real legal entity in a searchable registry, nothing else matters.
Frequently Asked Questions
How can I quickly check if a U.S. crypto exchange is registered? Search the platform's legal business name on FinCEN's MSB Registrant Search at msb.fincen.gov. This is a free, public database. If the exchange isn't listed, it isn't registered, and operating without registration is a federal violation.
Are non-custodial exchanges less risky than custodial ones? They carry different risks. Non-custodial platforms like Boomchange don’t hold your funds between transactions, which eliminates the custodial risk of exchange-side hacks or collapses. The trade-off is that you’re responsible for verifying the platform’s legitimacy through its track record, reviews, and fee transparency rather than through reserve audits.
What's the single most reliable red flag of a scam exchange? Inability to withdraw. If a platform accepts your deposit easily but stalls, blocks, or demands additional payments when you try to withdraw, it's almost certainly a scam. Test withdrawals with small amounts before committing anything significant.
Can Proof of Reserves be faked? Poorly implemented Proof of Reserves can be misleading, some platforms have published reserves without disclosing liabilities, making their solvency appear stronger than it is. Cryptographic Merkle-tree proofs that let individual users verify their own balance inclusion are the gold standard.
Should I use multiple exchanges? Yes. A Kraken survey found that 69 percent of crypto exchange users maintain accounts on multiple platforms, for fee optimization, token access, risk diversification, and separating trading from long-term holding. Spreading activity across verified platforms reduces your exposure to any single point of failure.